cGMP Food Packaging Certification: Audits for Food Packaging Manufacturers

A cGMP food packaging audit is an independent, on-site audit of a food packaging manufacturing facility against Kiwa ASI's cGMP Food Packaging 2.0 standard, a HACCP-based standard founded on FDA's 21 CFR Part 117. It covers three modules (Food Safety Management System, current Good Manufacturing Practices and HACCP) plus a mock recall completed in under two hours. Sites that score 70% or higher are certified, with an audit every year.

Manufacturers of food packaging, both packaging that touches food and packaging that doesn't, typically when a food manufacturer, brand owner or retailer asks its packaging suppliers for a third-party food safety audit. Food and beverage manufacturers use cGMP Food Processing, warehouses that only store and ship packaged products use cGDP Storage & Distribution, and sites that make both food and packaging can combine the Food Processing and Food Packaging standards in one certification scope.

A certification audit takes at least one full day (about 8 hours), and a scope extension audit at least half a day. Audits are planned in half-day increments and quoted during the application, based on the size of your facility and any satellite sites, the number of employees, your product types, processes and HACCP plans, and the scope. Duration is reviewed every year.

Every year. The certificate expires 30 days after the one-year anniversary of your last certification audit, and technical review can run past that date, so schedule the audit early enough to avoid a lapse. Each recertification audit that achieves compliance gives you a new certificate, score, rating and expiration date.

Yes. Kiwa ASI offers optional mock audits: unscored assessments that show compliance gaps before your scored certification audit. A mock audit can't be converted into a scored certification audit once it has started, and during it you need to show at least a mock production run or a walk-through of your process.

70% or higher. Every audit starts at 100%; each minor nonconformity deducts 1%, each major 5% and a critical 100%, so any critical nonconformity fails the audit. Ratings are Excellent (90–100%), Good (80–89%), Complies (70–79%) and Fails (0–69%), and two Excellent ratings in a row earn a Superior rating. Some customers require a higher score than 70%.

Yes. cGMP Food Packaging 2.0 is written for manufacturers of both direct food-contact and non-contact packaging, such as secondary and shipping packaging. Your product descriptions record each product's important safety characteristics, such as whether it's food contact or secondary packaging and its composition (requirement 3.2). Every requirement still applies, and any that doesn't fit your operation is recorded as not applicable.

No. FDA doesn't require packaging manufacturers to be certified; customers usually ask for it. FDA regulates the materials themselves: under 21 CFR 174.5, substances used in food-contact articles must be used under good manufacturing practice and be of a purity suitable for their intended use. FDA's compliance guide for 21 CFR Part 117 also notes that a facility that makes only food contact substances isn't required to register with FDA or to comply with its preventive controls rule for human food. The cGMP Food Packaging standard can't be used in place of any regulatory requirement.

Both use the same three modules, mock recall, scoring and certification rules, and most requirements are the same. Food Packaging is for makers of food-contact and non-contact packaging, and the main differences are allergen management (2.1.5: keeping unintended allergens out and verifying that cleaning removes them, without the processing standard's allergen receiving, storage and labeling rules), storage (2.13: one set of storage conditions, with temperature and humidity monitoring where needed) and product descriptions (3.2: food contact or secondary packaging instead of water activity, pH and allergens). Food Processing is for food and beverage manufacturers. Sites that do both can combine the two standards in one certification scope.

Because packaging, especially food-contact packaging, can carry allergen residues to your customers' food. Requirement 2.1.5 asks every site to control legally defined allergens: to keep unintended allergens out of manufacturing, including through suppliers, employees and visitors, even if you use no allergenic materials, and to show that cleaning and sanitation prevent allergen cross-contamination, with documented verification of allergen removal where applicable. Any cross-contamination of allergens is a critical nonconformity.

No. cGMP Food Packaging is Kiwa ASI's own audit standard. It isn't GFSI-benchmarked or accredited, although it draws on best practices from FSMA, Codex Alimentarius, ISO standards and GFSI-benchmarked schemes. If a customer requires GFSI-recognized certification, Kiwa ASI also audits packaging manufacturers to the SQF Food Safety Code: Manufacture of Food Packaging and offers FSSC 22000, which covers food packaging (category I). ASI Food Safety, LLC is accredited by ANAB for the SQF packaging code.

Version 2.0 took effect January 1, 2026, replacing the version 1.1 program from 2018. It reorganizes the requirements into three modules, states them in measurable terms and adds or expands management commitment and food safety culture, business licensing, certification integrity, electronic records, allergen management in packaging, risk-based zoning and environmental monitoring, one-forward and one-back traceability exercises, and a FSMA Food Safety Plan requirement (3.13). Reports now include unscored section summaries. Scoring and ratings didn't change. See the 2.0 change summary.

Only where FDA's preventive controls rule applies to your site. Requirement 3.13 calls for a Food Safety Plan developed and overseen by a trained Preventive Controls Qualified Individual (PCQI), with backup, at sites subject to FSMA's requirements. FDA's compliance guide for 21 CFR Part 117 notes that a facility that makes only food contact substances isn't required to register with FDA or to comply with that rule, while sites that also make, pack or hold food may be. Ask Kiwa ASI during the application how 3.13 applies to your site. Every site needs a HACCP plan under requirements 3.1–3.12.

Not for storage and shipping at your certified site. Requirement 2.13 covers storage conditions, receiving and shipping, and a Food Packaging certificate also reflects good distribution practices in principle. A nearby satellite site that's a direct extension of your processes and shares your management systems can be added to your scope with Kiwa ASI's approval, which may add audit time. Standalone warehouses and distribution centers that only store and ship packaged products use cGDP Storage & Distribution 2.0.

A clear deficiency that could cause serious illness or death, or any falsification of food safety records. The standard's examples include active or likely contamination of raw materials, work in progress or finished products; anything that would make you start a recall or withdrawal; live rodents in processing areas; allergen mislabeling or cross-contamination; non-potable water used in production or to clean product contact surfaces; equipment out of calibration that could lead to unsafe food; failure to correct a critical limit deviation; and chemicals used improperly.

No. Corrective actions aren't required to receive a certificate, but Kiwa ASI strongly recommends root cause analysis and corrective and preventive action. Findings that aren't corrected can be cited as repeat nonconformities, and auditors can upgrade them, for example from minor to major, at recertification.

At least 60 days of production records. If you can't provide them, Kiwa ASI decides whether to continue or stop the audit based on the records available. Your documented programs, training records, corrective action records and HACCP plan should also be current and ready before the auditor arrives.

Yes. Your facility must be in production on the audit day, or Kiwa ASI can abort the audit. If the production schedule changes after the audit is confirmed, you can demonstrate a small batch instead, as long as you tell Kiwa ASI in writing before the audit starts and still show every production step. For products that aren't running, the auditor samples historical production records.

During the audit, you trace raw materials one step back to their suppliers and finished product one step forward to your customers, accounting for 100% of the affected product, in under two hours with the auditor present. The auditor records lot numbers, quantities received, produced and shipped, any rework or recoup, and customer details. It doesn't count as your own annual mock recall, which requirement 2.3.4 also requires.

No. With Kiwa ASI's written approval, certified sites can use the ASI Certification Mark and logo while they're certified on marketing materials, product displays, brochures, advertisements, press releases and websites, but the Certification Mark can't be used on finished product labeling or packaging. You can also order a cGMP banner for your facility.

Tell Kiwa ASI. After a recall, notify Kiwa ASI within 24 hours as well as the regulatory agency, and share your investigation and follow-up so Kiwa ASI can decide whether any action is needed to keep your certificate. A new owner must notify Kiwa ASI within 30 calendar days of the ownership change. If you move, tell Kiwa ASI before the move date: the certificate ends when operations stop at the certified site, and the new site needs its own certification audit.

Cost depends mainly on audit time: at least one day, quoted in half-day increments from your facility size, employees, product types, processes and HACCP plans, and scope. Budget as well for any mock audit, training and facility improvements. Call 1 (800) 477-0778 or request a quote for your site.